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they can disable or bypass Secure Boot verification checks. 

Indeed, most implementations of Secure Boot will store UEFI NVRAM 
variables in SPI flash memory alongside the system firmware. Even though 
these variables are authenticated, and changing their values from the 
kernel mode by using the UEFI API requires a corresponding private key, 
an attacker capable of writing to SPI flash could change their content. 


Once an attacker has access to 
the UEFI NVRAM variables, they 
could, for example, tamper with 
PK, KEK, db, and dbx to add custom 
malicious certificates, which would 
allow a malicious module to bypass 
security checks. Another option 
would be to add the hash of the 
malicious file to the db database and 
remove it from the dbx database (in 
the case that the hash was originally 
in the dbx database). As shown in 
Figure 17-10, by changing the PK 
variable to include the attacker's 
public key certificate, the attacker is 
able to add and remove KEKs from 
the KEK UEFI variable, which, in 
turn, gives them control over the db 
and dbx signature databases, break- 
ing Secure Boot protection. 
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Figure 17-10: Attack against the UEFI 
Secure Boot chain of trust 


As a third option, instead of changing the PK and compromising the 
underlying PKI hierarchy, an attacker could simply corrupt the PK in the 
UEFI variable. In order to work, Secure Boot requires a valid PK enrolled 
into the platform firmware; otherwise, protection is disabled. 
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If you're interested in learning more about these attacks, the following 
conference papers contain comprehensive analyses of UEFI Secure Boot 
technology: 


e Corey Kallenberg et al., “Setup for Failure: Defeating Secure Boot,” 
LegbaCore, Attps://papers.put.as/bapers/firmware/2014/SetupForFailure 
-syscan-v4.pdf. 

e Yuriy Bulygin et al., “Summary of Attacks Against BIOS and 
Secure Boot,” Intel Security, http://www.c7zero.info/stuff/DEFCON22 
-BIOSAttacks.pdf. 


Protecting Secure Boot with Verified and Measured Boot 


As we've just discussed, Secure Boot alone is not capable of protecting 
against attacks that involve changes in platform firmware. So is there any 
protection for Secure Boot technology itself? The answer is yes. In this sec- 
tion, we'll focus on security technologies intended to protect system firm- 
ware against unauthorized modifications—namely, Verified and Measured 
Boot. Verified Boot checks that the platform firmware hasn't been altered 
or modified, while Measured Boot computes cryptographic hashes of cer- 
tain components involved in the boot process and stores them in Trusted 
Platform Module Platform Configuration Registers, or TPM PCRs. 

Verified Boot and Measured Boot function independently, and it's 
possible to have platforms with only one of them enabled, or with both. 
However, both Verified Boot and Measured Boot are part of the same 
chain of trust (as shown in Figure 17-11). 


Launch Verified апа Verify and measure Verify and measure 
Measured Boot platform firmware Launch Secure Boot OS bootloader 
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Figure 17-11: Verified and Measured Boot flow 
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As you saw in Figure 17-8, the PI firmware is the very first piece of code 
executed after the CPU comes out of reset. UEFI Secure Boot uncondition- 
ally trusts the PI firmware, so it makes sense that current attacks against 
Secure Boot rely on unauthorized modifications of it. 

In order to protect against such attacks, the system needs a root of trust 
outside the PI firmware. This is where Verified and Measured Boot come into 
play. These processes execute protection mechanisms whose root of trust is 
anchored in the hardware. Moreover, they execute before the system firm- 
ware, which means they are able to both authenticate and measure it. We'll 
discuss what measurement means in this context in a moment. 


Verified Boot 


When a system with Verified Boot is powered on, the hardware logic 
launches the boot verification functionality that's implemented in a boot 
ROM or microcode within the CPU. This logic is immutable, which means 
software can't change it. Usually, Verified Boot executes a module to 
verify the integrity of the system, ensuring that the system will execute 
the authentic firmware without malicious modifications. To verify the firm- 
ware, Verified Boot relies on public key cryptography; like UEFI Secure 
Boot, it checks the digital signature of the platform firmware to ensure its 
authenticity. After it's been successfully authenticated, the platform firm- 
ware is executed and proceeds to verify other firmware components (for 
example, the Option ROMs, DXE drivers, and OS bootloaders) to main- 
tain the proper chain of trust. That's the Verified portion of Verified and 
Measured Boot. Now for the Measured part. 


Measured Boot 


Measured Boot works by measuring the platform firmware and OS boot- 
loaders. This means it computes the cryptographic hashes of the com- 
ponents involved in the boot process. The hashes are stored in a set of 
TPM PCRs. The hash values themselves don't tell you if the measured 
components are benign or malicious, but they do tell you whether the 
configuration and boot components have been changed at some point. If 
a boot component has been modified, its hash value will differ from the 
one computed over the original version of the boot component. Thus, 
Measured Boot will notice any modification of the boot component. 

Later, the system software can use the hashes in these TPM PCRs to 
ensure the system is running in a known good state without any malicious 
modifications. The system might also use these hashes for remote attesta- 
tion, which is when a system tries to prove to another system that it’s in a 
trusted state. 

Now that you know how Verified and Measured Boot work in gen- 
eral, let's take a look at a couple implementations of it, starting with Intel 
BootGuard. 


Intel BootGuard 


Intel BootGuard is Intel's Verified and Measured Boot technology. 
Figure 17-12 shows the boot flow on a platform with Intel BootGuard 
enabled. 


CPU Boot ROM BootGuard Initial boot UEFI OS 
initialization 99 АСМ Ыоск firmware bootloader 


Figure 17-12: The Intel BootGuard flow 
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During initialization, before the CPU starts executing the first code 
located at the reset vector, it executes code from the boot ROM. This code 
performs the necessary initialization of the CPU state, then loads and exe- 
cutes the BootGuard Authenticated Code Module (ACM). 

The ACM is a special type of module for performing security-sensitive 
operations and must be signed by Intel. Thus, the boot ROM code that loads 
the ACM performs mandatory signature verification to keep the module 
from running unless it's signed by Intel. After successful signature verifica- 
tion, the ACM is executed in an isolated environment in order to prevent 
any malicious software from interfering with its execution. 

The BootGuard ACM implements Verified and Measured Boot func- 
tionality. This module loads the first-stage firmware loader, called the 
initial boot block (IBB), into memory and, depending on the boot policy 
in effect, verifies and/or measures it. The IBB is part of the firmware that 
contains code executed at the reset vector. 

Strictly speaking, at this point in the boot process there is no RAM. 
The memory controller hasn't yet been initialized, and RAM isn't acces- 
sible. However, the CPU configures its last-level cache so that it can be 
used as RAM by putting it in Cache-as-RAM mode until the point in the 
boot process when the BIOS memory reference code can configure the 
memory controller and discover RAM. 

The ACM transfers control to the IBB once the IBB is successfully 
verified and/or measured. If the IBB fails verification, the ACM behaves 
according to whatever boot policy is in effect: the system may be shut down 
immediately or allow firmware recovery after a certain timeout. 

The IBB then loads the rest of the UEFI firmware from SPI flash and 
verifies and/or measures it. Once the IBB receives control, Intel BootGuard 
is no longer responsible for maintaining the proper chain of trust, since its 
purpose is simply to verify and measure the IBB. The IBB is responsible for 
continuing the chain of trust up the point when UEFI Secure Boot takes 
over the verification and measuring of firmware images. 


Finding the ACM 


Let's look at the implementation details of Intel BootGuard technology 
for desktop platforms, starting with the ACM. Since the ACM is one of the 
first Intel BootGuard components executed when the system is powered 
up, the first question is: how does the CPU find the ACM when it is pow- 
ered on? 

The exact location of the ACM is provided in a special data structure 
called the Firmware Interface Table (FIT), stored in the firmware image. The 
FIT is organized as an array of FIT entries, each describing the location 
of a specific object in the firmware, such as the ACM or microcode update 
files. Figure 17-18 shows the layout of a FIT in system memory after reset. 


System memory map 


Ө Oxffffffco | ВТроіпег | | ВТроіпег | 


FIT | FiTentry#N | # | кТету#М | 


Firmware Interface толыт ы 
Table FIT entry #1 
FIT entry #0 


0x00000000 





Figure 17-13: The FIT’s location in memory 


When the CPU is powered on, it reads the address of the FIT from the 
memory location OXFFFFFFCO Ө. Since there's no RAM yet, when the CPU 
posts a read memory transaction for the physical address OxXFFFFFFCO, 
the internal chipset logic recognizes that this address belongs to a special 
address range and, instead of sending this transaction to the memory 
controller, decodes it. Read memory transactions for the FIT table are for- 
warded to the SPI flash controller, which reads FIT from flash memory. 

We'll take a closer look at this process by returning to the EDK2 repos- 
когу. In the IntelSiliconPkg/Include/IndustryStandard/ directory, you'll find 
the FirmwarelnterfaceTable.h header file, which contains some code defini- 
tions related to the FIT structure. The layout of FIT entries is shown in 
Listing 17-2. 


typedef struct { 
UINT64 Address; Ө 
UINT8 Size[3]; Ө 
UINT8 Reserved; 
UINT16 Version; Ө 
UINT8 Туре: 7; Ө 
UINT8 CV : 1; Ө 
UINT8 Chksum; © 
j FIRMWARE INTERFACE TABLE ENTRY; 





listing 17-2: Layout of FIT entries 


As mentioned, each FIT entry describes a certain object in the firm- 
ware image. The nature of each object is encoded in the FIT's Type field. 
These objects could be microcode update files, a BootGuard's ACM, or a 
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BootGuard policy, for instance. The Address field Ө and Size field Ө pro- 
vide the location of the object in memory: Address contains the physical 
address of the object, and Size defines the size expressed in dwords (4-byte 
values). The C v field Ө is the checksum valid field; if it's set to 1, the Chksum 
field Ө contains a valid checksum of the object. The sum of all the bytes 
in the component modulo OxFF and the value in the Chksum field must be 
zero. The Version field Ө contains the version number of the component in 
binary-coded decimal format. For the FIT header entry, the value in this 
field will indicate the revision number of the FIT data structure. 

The header FirmwarelnterfaceTable.h contains values that the Type field Ө 
can take. These type values are mostly undocumented, with little informa- 
tion available, but the definitions of FIT entry types are quite verbose, and 
you can deduce their meanings from the context. Here are the types rel- 
evant to BootGuard: 


e Тһе ҒІТ TYPE 00 HEADER entry provides the total number of FIT entries in 
the FIT table in its Size field. Its address field contains a special 8-byte 
signature, ' FIT ' (there are three spaces after | FIT ). 


e The entry of type FIT TYPE 02 STARTUP АСМ provides the location of the 
BootGuard ACM, which the boot ROM code parses to locate the ACM 
in system memory. 


e The entries of types FIT TYPE oC BOOT POLICY MANIFEST (BootGuard boot 
policy manifest) and FIT TYPE oB KEY MANIFEST (BootGuard key manifest) 
provide BootGuard with the boot policy that's in effect and the config- 
uration information, which we'll discuss shortly in "Configuring Intel 
BootGuard" on page 343. 


Keep in mind that the Intel BootGuard boot policy and the UEFI 
Secure Boot policy are two different things. The first term refers to the 
boot policy used for the Verified and Measured Boot procedures. That is, 
Intel BootGuard boot policy is enforced by ACM and chipset logic, and 
it includes parameters like whether BootGuard should perform Verified 
and Measured Boot and what BootGuard should do in cases when it fails 
to authenticate the IBB. The second term refers to UEFI Secure Boot, dis- 
cussed earlier in this chapter, and is entirely enforced by UEFI firmware. 


Exploring FIT 


You can explore some FIT entries in the firmware image using UEFITool, 
which we introduced in Chapter 15 (and which we'll discuss more in 
Chapter 19), and extract the ACM from the image, along with the boot 
policy and key manifests, for further analysis. This can be useful because 
the ACM can be used to hide malicious code. In the following example, 
we use a firmware image obtained from a system with Intel BootGuard 
technology enabled. (Chapter 19 provides information on how to acquire 
a firmware from the platform.) 


First, load the firmware image in UEFITool by selecting File > Open 
Image File. After specifying the firmware image file to load, you'll see a 


window like the one shown in Figure 17-14. 





{ UEFITool NE alpha 40 - image.bin 
File Action Help 


Structure Information 
Name Action Type Subtype Text Offset: FBFFE8h 
10C22623-DB6F -4721-AA30-4C12AF4230A7 File РЕІ module IdeRecovery Еа р. B52Or932-2A2/ 4195 B351. COGSÓOSSEOBA 
0002GAEB-F334-4C15-A7FO-E1E897E9FE91 File PEI module NvmeRecovery Кее 
89F06049-F297-4436-8540-EOBF9E92B568 File РЕТ module SdioRecovery Full size: 8618h (32792) 
9B3F28D5- 10A6-46C8-BA72-BD408847A71A File РЕТ module AmiTcgPlatformPeiA.. Header size: 18h (24) 
7703DC50-D428-4916-AC80-8F469035D150 File Raw Body size: 8000h (32768) 
Pad-file File Pad Tail size: 0h (0) 
6520F532-2A27-4195-B331-CO854683E0BA File ам State: FBh 
8E295870-D377-4875- BFDC-9AE2FGDBDE22 File Freeform Header checksum: DOh, valid 
5B85965C-455D-4CC6-9C4C-7F@86967D280 File Freeform Data checksum: AAh, valid 
Pad-file File Pad Header memory address: FFFBFFEBh 
C30FFF4A-10C6-4COF -A454- FD319BAFGCEG File ам Data memory address: FFFCQ@@h 
Pad-file File Pad Compressed: No 
7СӘЛӘВЕВ-2828-4027-8Е16-Е70277058025 File Кам Fixed: No 
пла £ilo Cilan пза 
Parser FIT Search Builder 
Address Size Version Checksum Type Information 
1.FIT. eoeooesoh 0100h өәһ FIT Header 
2 өгөөгөдәғғєлеөө 00017400h 0100h — 00h Microcode LocalOffset 00000018h, CPUID 000406t3h, Revision 00000074h, Date 01052016h 
з @2@0202FFE27490 00015000h 0100h ^ Geh Microcode Localoffset 00017418h, CPUID @@@426E2h, Revision e00@0028h, Date 04152015h 
4 0e000000FFF3C490 00017400h 0100h өеһ Microcode LocalOffset 0002C418h, CPUID 600506t3h, Revision 00000074h, Date 01052016h 
5 00000000ЕЕЕ53890 00012COOh O100h ^ 60h Microcode LocalOffset 00043818h, CPUID 000506E2h, Revision 0000002Ch, Date 07012015h 


[JoeoocooerrFCeeeo оөдөөгөөһ olh (oah BIOS ACM 


7 60000000FFFC9180 00000241h 0100h eh 
8 00009000FFFC8100 000002DFh 0100h eh 


Figure 17-14: Browsing FIT in UEFITool 


BootGuard Key Manifest 
BootGuard Boot Policy 


In the lower half of the window, you can see the FIT tab that lists the 


entries. The Type column of the FIT tab displays the type of FIT entries. We 
are looking for FIT entries for the types BIOS ACM, BootGuard key mani- 
fest, and BootGuard Boot Policy. Using that information, we can locate the 
Intel BootGuard components in the firmware image and extract them for 
further analysis. In this particular example, FIT entry #6 indicates the loca- 
tion of the BIOS АСМ; it starts at the address Oxfffc0000. FIT entries #7 and 
#8 indicate the locations of the key and boot policy manifests; they start at 
the addresses Oxfffc9180 and Oxfffc8100, respectively. 


Configuring Intel BootGvard 


Upon execution, the BootGuard BIOS ACM consumes the BootGuard key, 
while the boot policy locates the IBB in the system memory to obtain the 
correct public key to verify the IBB's signature. 

The BootGuard key manifest contains the hash of the boot policy 
manifest (BPM), the OEM root public key, the digital signature of the 
preceding fields (with the exception of the root public key, which isn't 
included in the signed data), and the security version number (a counter 
that is incremented with every security update, intended to prevent roll- 
back attacks). 
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The BPM itself contains the security version number, location, and hash 
of the IBB; the BPM public key; and digital signatures for the BPM fields 
just listed—again, with the exception of the root public key, which may be 
validated with the BPM public key. The location of the IBB provides the lay- 
out of the IBB in memory. This may not be in a contiguous memory block; 
it could consist instead of a few nonadjacent memory regions. The IBB hash 
contains the cumulative hash value of all the memory regions occupied 
by the IBB. Thus, the whole process of verifying the IBB's signature is as 
follows: 


l. BootGuard locates the key manifest (KM) using FIT and obtains the 
boot policy manifest hash value and the OEM root key, which we'll call 
key 1. BootGuard verifies the digital signature in the KM using key 1 
to ensure the integrity of the BPM hash value. If the verification fails, 
BootGuard reports an error and triggers remediation actions. 


2. Ifthe verification succeeds, BootGuard locates the BPM using FIT, 
computes a hash value of the BPM, and compares it with the BPM 
hash in the KM. If the values aren't equal, BootGuard reports an 
error and triggers remediation actions; otherwise, it obtains the 
IBB hash value and location from the BPM. 


3. BootGuard locates the IBB in memory, computes its cumulative hash, 
and compares it with the IBB hash value in the BPM. If the hashes 
aren't equal, BootGuard reports an error and triggers remediation 
actions. 


4. Otherwise, BootGuard reports that the verification succeeded. If 
Measured Boot is enabled, BootGuard also measures the IBB by 
calculating its hash and stores the measurement in the TPM. Then 
BootGuard transfers control to the IBB. 


The KM is an essential structure, as it contains the OEM root public key 
used to verify the integrity of the IBB. You might be asking, *If BootGuard's 
KM is stored in unprotected SPI flash along with firmware image, doesn't 
that mean attackers can modify it in flash to provide BootGuard with a fake 
verification key?" To prevent an attack like this, the hash of the OEM root 
public key is instead stored in the chipset's field-programmable fuses. These 
fuses can be programmed only once, at the point when the BootGuard boot 
policy is provisioned. Once the fuses are written, it's impossible to override 
them. This is how the BootGuard verification key is anchored in the hard- 
ware, making the hardware the immutable root of trust. (The BootGuard 
boot policy is stored in chipset fuses as well, making it impossible to alter 
the policy after the fact.) 

If an attacker changes the BootGuard key manifest, the ACM will spot 
the key alteration by computing its hash and comparing it with the “golden” 
value fused into the chipset. Mismatched hashes trigger an error report 
and remediation behavior. Figure 17-15 demonstrates the chain of trust 
enforced by BootGuard. 
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Figure 17-15: The Intel BootGuard chain of trust 


Once the IBB is successfully verified and, if necessary, measured, it 
executes and performs some basic chipset initialization, then loads the 
UEFI firmware. At this point, itis the IBB's responsibility to authenticate 
the UEFI firmware before loading and executing it. Otherwise, the chain 
of trust will be broken. 

Figure 17-16 concludes this section by representing the boundaries of 
responsibility for Secure Boot implementations. 
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Figure 17-16: The boundaries of responsibility for Secure Boot implementation 
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ARM has its own implementation of Verified and Measured Boot technol- 
ogy, called the Trusted Boot Board (TBB), ox simply Trusted Boot. In this sec- 
tion, we'll look at Trusted Boot's design. ARM has a very particular setup, 
known as Trust Zone security technology, that divides the execution environ- 
ment into two parts. Before we go into the Verified and Measured Boot pro- 
cess with ARM, we need to describe how Trust Zone works. 


ARM Trust Zone 


Trust Zone security technology is a hardware-implemented security feature 
that separates the ARM execution environment into two worlds: the secure 
world and the normal (or nonsecure) world, which coexist on the same 
physical core, as shown in Figure 17-17. The logic implemented in the pro- 
cessor's hardware and firmware ensures that the secure world's resources 
are properly isolated and protected from software running in the non- 
secure world. 
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User applications 
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Figure 17-17: The ARM Trust Zone 





Both worlds have their own dedicated and distinct firmware and soft- 
ware stacks: the normal world executes user applications and an OS, while 
the secure world executes a secure OS and trusted services. The firmware 
of these worlds consists of different bootloaders responsible for initializing 
the world and loading the OS, which we’ll talk about in a moment. For this 
reason, the secure and normal worlds have different firmware images. 

Within the processor, software running in the normal world cannot 
access code and data in the secure world directly. The access control logic 


that prevents this is implemented in the hardware, usually in the System on 
Chip hardware. However, software running in the normal world can trans- 
fer control to the software located in the secure world (for instance, to exe- 
cute a trusted service in the secure world) using particular software called 

Secure Monitor (in ARM Cortex-A) or core logic (in ARM Cortex-M). This 
mechanism ensures that switches between worlds don't violate the security 

of the system. 

Together, the Trusted Boot technology and Trust Zone create the 
Trusted Execution Environment, used to run software with high privi- 
leges and provide an environment for security technologies like digital 
rights management, cryptography and authentication primitives, and 
other security-sensitive applications. In this way, an isolated, protected 
environment may house the most sensitive software. 


ARM Boot Loaders 


Because the secure and normal worlds are kept separate, each world needs 
its own set of bootloaders. Also, the boot process for each world consists of 
multiple stages, which means a number of bootloaders must execute at dif- 
ferent points in the boot process. Here, we'll describe the Trusted Boot flow 
for ARM application processors in general terms, beginning with the fol- 
lowing list of bootloaders involved in Trusted Boot. We showed these back 
in Figure 17-17: 


ВІЛ Firststage bootloader, located in boot ROM and executed in the 
secure world. 


BL2 Second-stage bootloader, located in flash memory, loaded and 
executed by ВІЛ in the secure world. 


BL31 Secure-world runtime firmware, loaded and executed by BL2. 
BL32 Optional secure-world third-stage bootloader, loaded by BL2. 


BL33 Normal-world runtime firmware, loaded and executed by BL2. 


This list isn’t a complete and accurate list of all the ARM implementa- 
tions in the real world, as some manufacturers introduce additional boot- 
loaders or remove some of the existing ones. In some cases, BL] may not be 
the very first code executed on the application processor when the system 
comes out of reset. 

To verify the integrity of these boot components, Trusted Boot relies 
on X.509 public key certificates (remember that the files in UEFI Secure 
Boot’s db database were encoded with X.509). It’s worth mentioning that 
all certificates are self-signed. There is no need for a certificate authority, 
because the chain of trust is not established by the validity of a certificate’s 
issuer but rather by the content of the certificate extensions. 

Trusted Boot uses two types of certificates: key and content certificates. It 
uses key certificates first to verify the public keys that are used to sign con- 
tent certificates. Then it uses the content certificates to store the hashes of 
boot loader images. This relationship is illustrated in Figure 17-18. 
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Figure 17-18: Trusted Boot key and content certificates 


Trusted Boot authenticates an image by calculating its hash and match- 
ing the result with the hash extracted from the content certificate. 


Trusted Boot Flow 


Now that you're familiar with the foundational concepts of Trusted Boot, 
let's take a look at the Trusted Boot flow for an application processor, shown 
in Figure 17-19. This will give you the full picture of how Verified Boot is 
implemented in ARM processors and how it protects platforms from the 
execution of untrusted code, including firmware rootkits. 

In Figure 17-19, solid arrows denote the transfer of execution flow, and 
dashed arrows denote the trust relationship; in other words, each element 
trusts the element its dotted arrow points to. 

Once the CPU is released from reset, the first piece of the code executed 
is bootloader 1 (BL1) Ө. BL1 is loaded from the read-only boot ROM, which 
means it can't be tampered with while it's stored there. BLI reads the boot- 
loader 2 (BL2) content certificate © from flash memory and checks its issuer 
key. BLI then computes the hash of the BL2 content certificate issuer and 
compares it with the “golden” values stored in the secure root of trust public 
key register (ROTPK) register © in the hardware. The ROTPK register and 
boot ROM are the roots of trust, anchored in hardware for Trusted Boot. If 
the hashes aren't equal or verification of the BL2 content certificate signa- 
ture fails, the system panics. 

Once the BL2 content certificate is verified against the ROTPK, BL1 
loads the BL2 image from flash Ө, computes its cryptographic hash, and 
compares this hash value with the value obtained from the BL2 content cer- 
tificate Ө. 

Once authenticated, ВІ] transfers control to BL2, which, in turn, reads 
its trusted key certificate @ from flash memory. This trusted key certificate 
contains public keys for the verification of the firmware for both the secure 
world @ and the normal world Ө. The key that issued the trusted key cer- 
tificate is checked against the ROTPK register ©. 

Next, BL2 authenticates BL31 6, which is the runtime firmware for the 
secure world. To authenticate the BL31 image, BL2 uses the key certificate 
and content certificate for BL31 Ө. BI2 verifies these key certificates by 


using the secure world public key obtained from the trusted key certificate. 
The BL31 key certificate contains the BL31 content certificate public key 
used to verify the signature of the BL32 content certificate. 
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Figure 17-19: Trusted Boot flow 


Once the BL31 content certificate is verified, the hash value of the BL31 
image stored within this BL31 certificate is used to check the integrity of the 
BL3 image. Again, any failures result in a system panic. 

Similarly, BL2 checks the integrity of the optional secure-world BL32 
image using the BL32 key and content certificates. 

The integrity of the BL33 firmware image (executed in the normal 
world) is checked with the BL33 key and BL33 content certificates. The 
BL33 key certificate is verified with the normal world public key obtained 
from the trusted key certificate. 

If all the checks pass successfully, the system proceeds by executing the 
authenticated firmware for both the secure and normal worlds. 
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AMD HARDWARE VALIDATED BOOT 


Although not discussed in this chapter, AMD has its own implementation of 
Verified and Measured Boot called Hardware Validated Boot (HVB). This tech- 


nology implements functionality similar to Intel BootGuard. Based on AMD 
Platform Security Processor technology, it has a microcontroller devoted to 
security-related computations that runs independently of the system's main core. 





Verified Boot vs. Firmware Rootkits 


With all of this knowledge in hand, let's finally see whether Verified Boot 
can protect against firmware rootkits. 

We know that Verified Boot takes place before any firmware is executed 
in the boot process. This means that when Verified Boot starts verifying firm- 
ware, any infecting firmware rootkit won't yet be active, so the malware can't 
counteract the verification process. Verified Boot will detect any malicious 
modification of firmware and prevent its execution. 

Moreover, the root of trust for Verified Boot is anchored in the hard- 
ware, so attackers can't tamper with it. Intel BootGuard's OEM root public 
key is fused into the chipset, and ARM's root of trust key is stored in secure 
registers. In both cases, the boot code that triggers Verified Boot is loaded 
from read-only memory, so malware can't patch or modify it. 

So, we can conclude that Verified Boot can withstand attacks from 
firmware rootkits. However, as you might have observed, the whole tech- 
nology is quite complex; it has many dependencies, so it could easily be 
implemented incorrectly. This technology is only as secure as its weakest 
component; a single flaw in the chain of trust makes it possible to bypass. 
That means there's a good chance attackers could find vulnerabilities in an 
implementation of Verified Boot to exploit and install firmware rootkits. 


Conclusion 


Chapter 17 


In this chapter, we explored three Secure Boot technologies: UEFI Secure 
Boot, Intel BootGuard, and ARM Trusted Boot. These technologies rely on 
a chain of trust—enforced from the very beginning of the boot process to 
the execution of user applications—and involve an enormous number of 
boot modules. When correctly configured and implemented, they provide 
protection against the ever-growing number of UEFI firmware rootkits. 
That's why high-assurance systems must use Secure Boot, and why, these 
days, many consumer systems enable Secure Boot by default. In the next 
chapter, we'll focus on forensic approaches for analyzing firmware rootkits. 





APPROACHES TO ANALYZING 
HIDDEN FILESYSTEMS 


So far in this book, you've learned how 
bootkits penetrate and persist on the 
victim's computer by using sophisticated 





techniques to avoid detection. One common 
characteristic of these advanced threats is the use of 
a custom hidden storage system for storing modules 
and configuration information on the compromised 
machine. 


Many of the hidden filesystems in malware are custom or altered ver- 
sions of standard filesystems, meaning that performing forensic analysis on 
a computer compromised with a rootkit or bootkit often requires a custom 
toolset. In order to develop these tools, researchers must learn the layout of 
the hidden filesystem and the algorithms used to encrypt data by perform- 
ing in-depth analyses and reverse engineering. 

In this chapter, we'll look more closely at hidden filesystems and 
methods to analyze them. We'll share our experiences of performing 
long-term forensic analyses of the rootkits and bootkits described in this 
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book. We'll also discuss approaches to retrieving data from hidden storage 
and share solutions to common problems that arise through this kind of 
analysis. Finally, we'll introduce the custom HiddenFsReader tool we devel- 
oped, whose purpose is to dump the contents of the hidden filesystems in 
specific malware. 


Overview of Hidden Filesystems 


Chapter 18 


Figure 18-1 illustrates an overview of the typical hidden filesystem. We 
can see the malicious payload that communicates with the hidden storage 
injected into the user-mode address space of a victim process. The pay- 
load often uses the hidden storage to read and update its configuration 
information or to store data like stolen credentials. 


Applications Malware payload 


User-mode address space 


Kernel-mode address space 










Malicious kernel-mode driver 


| . Filesystem interface 
OS filesystem driver 
Physical storage interface 


OS storage device driver stack 
Hard drive : pas 
filesystem area 


Figure 18-1: Typical malicious hidden filesystem implementation 








The hidden storage service is provided through the kernel-mode mod- 
ule, and the interface exposed by the malware is visible only to the payload 
module. This interface usually isn't available to other software on the system 
and cannot be accessed via standard methods such as Windows File Explorer. 

Data stored by the malware on the hidden filesystem persists in an area 
of the hard drive that isn't being used by the OS in order not to conflict 
with it. In most cases, this area is at the end of the hard drive, because there 
is usually some unallocated space. However, in some cases, such as the 
Rovnix bootkit discussed in Chapter 11, malware can store its hidden file- 
system in unallocated space at the beginning of the hard drive. 

The main goal of any researcher performing forensic analysis is to 
retrieve this hidden stored data, so next we'll discuss a few approaches for 
doing so. 


Retrieving Bootkit Data from a Hidden Filesystem 


We can obtain forensic information from a bootkit-infected computer by 
retrieving the data when the infected system is offline or by reading the 
malicious data from a live infected system. 

Each approach has its pros and cons, which we'll consider as we discuss 
the two methods. 


Retrieving Data from an Offline System 


Let's start with getting data from the hard drive when the system is offline 
(that is, the malware is inactive). We can achieve this through an offline 
analysis of the hard drive, but another option is to boot the noninfected 
instance of the operating system using a live CD. This ensures the com- 
puter uses the noncompromised bootloader installed on the live CD, so 
the bootkit won't be executed. This approach assumes that a bootkit has 
not been able to execute before the legitimate bootloader and cannot 
detect an attempt to boot from an external device to wipe the sensitive 
data beforehand. 

The significant advantage of this method over an online analysis is that 
you don't need to defeat the malware's self-defense mechanisms that pro- 
tect the hidden storage contents. As we'll see in later sections, bypassing the 
malware's protection isn't a trivial task and requires certain expertise. 


Once you get access to the data stored on the hard drive, you can proceed with 
dumping the image of the malicious hidden filesystem and decrypting and pars- 
ing it. Different types of malware require different approaches for decrypting and 
parsing the hidden filesystems, as we'll discuss in the section *Parsing the Hidden 
Filesystem Image" on page 360. 


However, the downside of this method is that it requires both physical 
access to the compromised computer and the technical know-how to boot 
the computer from a live CD and dump the hidden filesystem. Meeting 
both of these requirements might be problematic. 

If analyzing on an inactive machine isn't possible, we have to use the 
active approach. 


Reading Data on a Live System 


Оп а live system with an active instance of the bootkit, we need to dump 
the contents of the malicious hidden filesystem. 

Reading the malicious hidden storage on a system actively running 
malware, however, has one major difficulty: the malware may attempt to 
counteract the read attempts and forge the data being read from the hard 
drive to impede forensic analysis. Most of the rootkits we've discussed in this 
book—TDL3, TDL4, Rovnix, Olmasco, and so on—monitor access to the 
hard drive and block access to the regions with the malicious data. 

To be able to read malicious data from the hard drive, you have to over- 
come the malware's self-defense mechanisms. We'll look at some approaches 
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to this in a moment, but first we'll examine the storage device driver stack 

in Windows, and how the malware hooks into it, to better understand how 

the malware protects the malicous data. This information is also useful for 
understanding certain approaches to removing malicious hooks. 


Hooking the Miniport Storage Driver 


We touched upon the architecture of the storage device driver stack in 
Microsoft Windows and how malware hooks into it in Chapter 1. This 
method outlived the TDL3 and was adopted by later malware, including 
bootkits we've studied in this book. Here we'll go into more detail. 

TDL3 hooked the miniport storage driver located at the very bottom of 
the storage device driver stack, as indicated in Figure 18-2. 








Filesystem drivers 
(ntfs.sys, fastfat.sys, and so оп) 
Storage class drivers 
(disk.sys, and so on) 


Storage port drivers 
(scsiport.sys, storport.sys, and so on) 


SCSI Storport ATA IDE 
miniport | | miniport | | miniport | | miniport 


Figure 18-2: Device storage driver stack 


Hooking into the driver stack at this level allows the malware to moni- 
tor and modify I/O requests going to and from the hard drive, giving it 
access to its hidden storage. 

Hooking at the very bottom of the driver stack and directly communicat- 
ing with the hardware also allows the malware to bypass the security software 
that operates at the level of the filesystem or disk class driver. As we touched 
upon in Chapter 1, when an I/O operation is performed on the hard drive, 
the OS generates an input/output request packet (IRP) —a special data struc- 
ture in the operating system kernel that describes I/O operation—which is 
passed through the whole device stack from top to the bottom. 


Security software modules responsible for monitoring hard drive I/O 
operations can inspect and modify IRP packets, but because the malicious 
hooks are installed at the level below security software, they're invisible to 
these security tools. 

There are several other levels a bootkit might hook, such as the user- 
mode API, filesystem driver, and disk class driver, but none of them allow 
the malware to be as stealthy and powerful as the miniport storage level. 


The Storage Device Stack Layout 


We won’t cover all possible miniport storage hooking methods in this section. 
Instead, we’ll focus on the most common approaches that we’ve come across 
in the course of our malware analyses. 

First, we'll take a closer look at the storage device, shown in Figure 18-3. 


Ө Storage miniport Storage miniport Storage miniport 
DEVICE_OBJECT DRIVER_OBJECT driver image 


DriverObject 


Figure 18-3: Miniport storage device organization 





The IRP goes from the top of the stack to the bottom. Each device in the 
stack can either process and complete the I/O request or forward it to the 
device one level below. 

The DEVICE ОВЈЕСТ Ө is a system data structure used by the operating 
system to describe a device in the stack, and it contains a pointer to the 
corresponding DRIVER 0BJECT, another system data structure that describes a 
loaded driver in the system. In this case, the DEVICE 0BJECT contains a pointer 
to the miniport storage driver. 

The layout of the DRIVER 0BJECT structure is shown in Listing 18-1. 





typedef struct DRIVER OBJECT { 
SHORT Type; 
SHORT Size; 
€ PDEVICE OBJECT DeviceObject; 
ULONG Flags; 
PVOID DriverStart; 
ULONG DriverSize; 
PVOID DriverSection; 
PDRIVER EXTENSION DriverExtension; 
O UNICODE STRING DriverName; 
PUNICODE STRING HardwareDatabase; 
PFAST IO DISPATCH FastIoDispatch; 
Ө LONG * DriverInit; 
PVOID DriverStartIo; 
PVOID DriverUnload; 


ee 
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Ө LONG * MajorFunction[28]; 
j DRIVER OBJECT, *PDRIVER OBJECT; 





Listing 18-1: The layout of the DRIVER 0BJECT structure 


The DriverName field contains the name of the driver described by the 
structure; DriverStart Ө and DriverSize Ө, respectively, contain the starting 
address and size in the driver memory; DriverInit Ө contains a pointer to the 
driver's initialization routine; and DeviceObject ® contains a pointer to the list 
of DEVICE 0BJECT structures related to the driver. From the malware's point of 
view, the most important field is MajorFunction @, which is located at the end 
of the structure and contains the addresses of the handlers implemented in 
the driver for various I/O operations. 

When an I/O packet arrives at a device object, the operating system 
checks the DriverObject field in the corresponding DEVICE 0BJECT structure to 
get the address of DRIVER 0BJECT in memory. Once the kernel has the DRIVER 
. OBJECT structure, it fetches the address of a corresponding I/O handler from 
the MajorFunction array relevant to the type of I/O operation. With this infor- 
mation, we can identify parts of the storage device stack that can be hooked 
by the malware. Let's look at a couple of different methods. 


Direct Patching of the Miniport Storage Driver Image 


One way to hook the miniport storage driver is to directly modify the driver's 
image in memory. Once the malware obtains the address of the hard disk 
miniport device object, it looks at the DriverObject to locate the correspond- 
ing DRIVER 0BJECT structure. The malware then fetches the address of the hard 
disk I/O handler from the MajorFunction array and patches the code at that 
address, as shown in Figure 18-4 (the sections in gray are those modified by 
the malware). 


Storage miniport Storage miniport Storage miniport 
DEVICE OBJECT DRIVER OBJECT driver image 
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Malicious driver 
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Figure 18-4: Hooking the storage driver stack by patching the miniport driver 


When the device object receives an I/O request, the malware is exe- 
cuted. The malicious hook can now reject I/O operations to block access 
to the protected area of the hard drive, or it can modify I/O requests to 
return forged data and fool the security software. 

For example, this type of hook is used by the Gapz bootkit discussed 
in Chapter 12. In the case of Gapz, the malware hooks two routines on 
the hard disk miniport driver that are responsible for handling the IRP MJ 
.INTERNAL DEVICE CONTROL and IRP MJ DEVICE CONTROL I/O requests to protect 
them from being read or overwritten. 

However, this approach is not particularly stealthy. Security software 
can detect and remove the hooks by locating an image of the hooked driver 
on a filesystem and mapping it into memory. It then compares the code sec- 
tions of the driver loaded into the kernel to a version of the driver manually 
loaded from the file, and it notes any differences in the code sections that 
could indicate the presence of malicious hooks in the driver. 

The security software can then remove the malicious hooks and restore 
the original code by overwriting the modified code with the code taken 
from the file. This method assumes that the driver on the filesystem is gen- 
uine and not modified by the malware. 


DRIVER OBJECT Modification 


The hard drive miniport driver can also be hooked through the modifica- 
tion of the DRIVER 0BJECT structure. As mentioned, this data structure con- 
tains the location of the driver image in memory and the address of the 
driver's dispatch routines in the MajorFunction array. 

Therefore, modifying the MajorFunction array allows the malware 
to install its hooks without touching the driver image in memory. For 
instance, instead of patching the code directly in the image as in the 
previous method, the malware could replace entries in the MajorFunction 
array related to IRP MJ INTERNAL DEVICE CONTROL and IRP MJ DEVICE CONTROL I/O 
requests with the addresses of the malicious hooks. As a result, the operat- 
ing system kernel would be redirected to the malicious code whenever it 
tried to resolve the addresses of handlers in the DRIVER OBJECT structure. 
This approach is demonstrated in Figure 18-5. 

Because the driver's image in memory remains unmodified, this 
approach is stealthier than the previous method, but it isn't invulnerable 
to discovery. Security software can still detect the presence of the hooks 
by locating the driver image in memory and checking the addresses of 
the IRP MJ INTERNAL DEVICE CONTROL and IRP MJ DEVICE CONTROL I/O requests 
handlers: if these addresses don't belong to the address range of the 
miniport driver image in memory, it indicates that there are hooks in 
the device stack. 
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Figure 18-5: Hooking the storage driver stack by patching the miniport DRIVER OBJECT 


On the other hand, removing these hooks and restoring the original 
values of the MajorFunction array is much more difficult than with the pre- 
vious method. With this approach, the MajorFunction array is initialized 
by the driver itself during execution of its initialization routine, which 
receives a pointer to the partially initialized corresponding DRIVER OBJECT 
structure as an input parameter and completes the initialization by filling 
the MajorFunction array with pointers to the dispatch handlers. 

Only the miniport driver is aware of the handler addresses. The secu- 
rity software has no knowledge of them, making it much more difficult to 
restore the original addresses in the DRIVER 0BJECT structure. 

One approach that the security software may use to restore the original 
data is to load the miniport driver image in an emulated environment, cre- 
ate a DRIVER OBJECT structure, and execute the driver's entry point (the ini- 
tialization routine) with the DRIVER 0BJECT structure passed as a parameter. 
Upon exiting the initialization routine, the DRIVER 0BJECT should contain the 
valid MajorFunction handlers, and the security software can use this informa- 
tion to calculate the addresses of the I/O dispatch routines in the driver's 
image and restore the modified DRIVER 0BJECT structure. 

Emulation of the driver can be tricky, however. If a driver's initializa- 
tion routine implements simple functionality (for example, initializing the 
DRIVER OBJECT structure with the valid handler addresses), this approach 
would work, but if it implements complex functionality (such as calling sys- 
tem services or a system API, which are harder to emulate), emulation may 
fail and terminate before the driver initializes the data structure. In such 
cases, the security software won't be able to recover the addresses of the 
original handlers and remove the malicious hooks. 

Another approach to this problem is to generate a database of the orig- 
inal handler addresses and use it to recover them. However, this solution 


lacks generality. It may work well for the most frequently used miniport 
drivers but fail for rare or custom drivers that were not included in the 
database. 


DEVICE OBJECT Modification 


The last approach for hooking the miniport driver that we'll consider in 
this chapter is a logical continuation of the previous method. We know that 
to execute the I/O request handler in the miniport driver, the OS kernel 
must fetch the address of the DRIVER ОВЈЕСТ structure from the miniport 
DEVICE OBJECT, then fetch the handler address from the MajorFunction array, 
and finally execute the handler. 

So, another way of installing the hook is to modify the DriverObject 
field in the related DEVICE 0BJECT. The malware needs to create a rogue 
DRIVER 0BJECT structure and initialize its MajorFunction array with the address 
of the malicious hooks, after which the operating system kernel will use 
the malicious DRIVER 0BJECT structure to get the address of the I/O request 
handler and execute the malicious hook (Figure 18-6). 
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Figure 18-6: Hooking the storage driver stack by hijacking miniport DRIVER_OBJECT 


This approach is used by TDL3/TDL4, Rovnix, and Olmasco, and it 
has similar advantages and drawbacks as the previous approach. However, 
its hooks are even harder to remove because the whole DRIVER_OBJECT is 
different, meaning security software would need to make extra efforts to 
locate the original DRIVER_OBJECT structure. 

This concludes our discussion of device driver stack hooking techniques. 
As we've seen, there's no simple generic solution for removing the malicious 
hooks in order to read the malicious data from the protected areas of an 
infected machine’s hard drive. Another reason for the difficulty is that there 
are many different implementations of miniport storage drivers, and since 
they communicate directly with the hardware, each storage device vendor 
provides custom drivers for its hardware, so approaches that work for a cer- 
tain class of miniport drivers will fail for others. 
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Parsing the Hidden Filesystem Image 


Once the rootkit's self-defense protection is deactivated, we can read data 
from the malicious hidden storage, which yields the image of the mali- 
cious filesystem. The next logical step in forensic analysis is to parse the 
hidden filesystem and extract meaningful information. 

To be able to parse a dumped filesystem, we need to know which type 
of malware it corresponds to. Each threat has its own implementation of the 
hidden storage, and the only way to reconstruct its layout is to engineer the 
malware to understand the code responsible for maintaining it. In some 
cases, the layout of the hidden storage can change from one version to 
another within the same malware family. 

The malware may also encrypt or obfuscate its hidden storage to make 
it harder to perform forensic analysis, in which case we'd need to find the 
encryption keys. 

Table 18-1 provides a summary of hidden filesystems related to the 
malware families we've discussed in previous chapters. In this table, we con- 
sider only the basic characteristics of the hidden filesystem, such as layout 
type, encryption used, and whether it implements compression. 


Table 18-1: Comparison of Hidden Filesystem Implementations 


Functionality/malware TDL4 Rovnix Olmasco Gapz 

Filesystem type Custom FAT16 Custom Custom 
modification 

Encryption XOR/RCA Custom RC6 RCA 
(XOR+ROL) modification 

Compression No Yes No Yes 


As we can see, each implementation is different, creating difficulties for 
forensic analysts and investigators. 


The HiddenFsReader Tool 


Chapter 18 


In the course of our research on advanced malware threats, we’ve reverse 
engineered many different malware families and have managed to gather 
extensive information on various implementations of hidden filesystems 
that may be very useful to the security research community. For this reason, 
we've implemented a tool named HiddenFsReader (hitp://download.eset.com/ 
special/ ESETHfsReader.exe/) that automatically looks for hidden malicious 
containers on a computer and extracts the information contained within. 
Figure 18-7 depicts the high-level architecture of the HiddenFsReader. 
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Figure 18-7: High-level architecture of HiddenFsReader 





The HiddenFsReader consists of two components: a user-mode appli- 
cation and a kernel-mode driver. The kernel-mode driver essentially 
implements the functionality for disabling rootkit/bootkit self-defense 
mechanisms, and the user-mode application provides the user with an 
interface to gain low-level access to the hard drive. The application uses 
this interface to read actual data from the hard drive, even if the system is 
infected with an active instance of the malware. 

The user-mode application itself is responsible for identifying hidden 
filesystems read from the hard drive, and it also implements decryption func- 
tionality to obtain the plaintext data from the encrypted hidden storage. 

The following threats and their corresponding hidden filesystems 
are supported in the latest release of the HiddenFsReader at the time of 
writing: 

e Win32/Olmarik (TDL3/TDL3+/TDL4) 
e = Win32/Olmasco (MaxXSS) 

e Win32/Sirefef (ZeroAccess) 

e = Win32/Rovnix 

e = Win32/Xpaj 

e = Win32/Gapz 

e Win32/Flamer 

е Win32/Urelas (GBPBoot) 

e = Win32/Avatar 
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These threats employ custom hidden filesystems to store the payload 
and configuration data, better protecting against security software and mak- 
ing forensic analysis harder. We haven't discussed all of these threats in this 
book, but you can find information on them in the list of references avail- 
able at hitps://nostarch.com/rootkits/. 


Conclusion 


Chapter 18 


The implementation of a custom hidden filesystem is common for advanced 
threats like rootkits and bootkits. Hidden storage is used to keep configura- 
tion information and payloads secret, rendering traditional approaches to 
forensic analysis ineffective. 

Forensic analysts must disable the threat’s self-defense mechanisms 
and reverse engineer the malware. In this way, they can reconstruct the 
hidden filesystem’s layout and identify the encryption scheme and key 
used to protect the malicious data. This requires extra time and effort 
on a per-threat basis, but this chapter has explored some of the possible 
approaches to tackling these problems. In Chapter 19, we will continue 
to explore forensic analysis of malware, focusing specifically on UEFI 
rootkits. We will provide information on UEFI firmware acquisition and 
analysis with respect to malware targeting UEFI firmware. 





BIOS/UEFI FORENSICS: 
FIRMWARE ACQUISITION AND 
ANALYSIS APPROACHES 


Recent rootkits targeting UEFI firmware 
have renewed interest in UEFI firmware 





forensics. Leaks of classified information 

on state-sponsored BIOS implants, as well as 
the security breach at Hacking Team mentioned 
in Chapter 15, have demonstrated the increasingly 
stealthy and powerful capabilities of malware that tar- 
gets the BIOS and prompted the research community 


to dig deeper into firmware. We've already discussed some technical details 
of these BIOS threats in previous chapters. If you haven't read Chapters 15 
and 16, we highly recommend doing so before continuing; those chapters 
cover important firmware security concepts that we assume you understand 
for this discussion. 


In this chapter, we use the terms BIOS and UEFI firmware interchangeably. 
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UEFI firmware forensics is currently an emerging area of research, 
so security researchers working in this field lack conventional tools and 
approaches. In this chapter, we'll cover some firmware analysis techniques, 
including various approaches to firmware acquisition and methods of pars- 
ing and extracting useful information. 

We first focus on acquiring firmware, which is usually the first step of 
a forensic analysis. We cover both a software and a hardware approach to 
obtaining a UEFI firmware image. Next, we compare these approaches 
and discuss the advantages and disadvantages of each. We then discuss 
the internal structure of the UEFI firmware image and how to parse it 
in order to extract forensic artifacts. In the context of this discussion, we 
show you how to use UEFITool, an indispensable open source firmware 
analysis tool for browsing and modifying UEFI firmware images. Finally, 
we discuss Chipsec, a tool with very extensive and powerful functionality, 
and consider its applications for forensics analysis. Both tools were intro- 
duced in Chapter 15. 


Limitations of Our Forensic Techniques 


The material we present here does have some limitations. In modern plat- 
forms, there are many types of firmware: UEFI firmware, Intel ME firmware, 
hard drive controller firmware, and so on. This chapter is dedicated specifi- 
cally to the analysis of UEFI firmware, which constitutes one of the largest 
parts of platform firmware. 

Note also that firmware is very platform specific; that is, each platform 
has its own peculiarities. In this chapter, we'll focus on UEFI firmware for 
Intel x86 systems, which constitute the majority of desktop, laptop, and 
server market segments. 


Why Firmware Forensics Matter 


Chapter 19 


In Chapter 15, we saw that modern firmware is a convenient place for 
embedding very powerful backdoors or rootkits, specifically in the BIOS. 
This type of malware is capable of surviving OS reinstallation or hard drive 
replacement, and it gives an attacker control over an entire platform. At the 
time of this writing, most state-of-the-art security software doesn't take into 
account UEFI firmware threats at all, making them even more dangerous. 
This gives an attacker a big opportunity to implant malware that persists 
undetected on the target system. 

Next, we outline a couple of specific ways attackers might use firmware 
rootkits. 


Attacking the Supply Chain 


Threats targeting UEFI firmware increase the risk of supply chain 
attacks, because attackers can install a malicious implant on a server 
before it is delivered to the data center or to a laptop before it gets to the 


IT department. And because these threats can impact a large number of a 
service provider's clients by exposing all their secrets, big cloud-computing 
players like Google have recently started to use firmware forensic analysis 
techniques to ensure that their firmware isn't compromised. 


GOOGLE TITAN CHIP 


In 2017, Google publicly introduced Titan, a chip that protects platform firm- 
ware by establishing a hardware root of trust. Trusting your hardware con- 
figuration is important, especially when it comes to cloud security, where the 
impact of an attack is multiplied by the number of affected clients. 
Companies that work with big clouds and data, like Amazon, Google, 
Microsoft, Facebook, and Apple, are working on developing (or have devel- 
oped) hardware to control the platform root of trust. Even if attackers use a 


firmware rootkit to compromise a platform, having an isolated root of trust will 


prevent Secure Boot attacks and firmware update attacks. 





Compromising BIOS Through Firmware Vulnerability 


Attackers can compromise the platform firmware by exploiting a vul- 
nerability in it to bypass BIOS write protection or authentication. For a 
refresher on this attack, return to Chapter 16, where we discuss different 
classes of vulnerabilities used to attack the BIOS. To detect these attacks, 
you could use the firmware forensic approaches discussed in this chapter 
to verify the integrity of a platform's firmware or to help detect malicious 
firmware modules. 


Understanding Firmware Acquisition 


The very first step in BIOS forensic analysis is the process of obtaining an 
image of the BIOS firmware to analyze. To better understand the location 
of BIOS firmware on modern platforms, refer to Figure 19-1, which demon- 
strates the architecture of a typical PC system's chipset. 

There are two main components in the chipset: a CPU and a Platform 
Controller Hub (PCH) or South Bridge. The PCH provides a connection 
between the controllers of peripheral devices available on the platform and 
the CPU. In most modern systems based on Intel x86 architecture (includ- 
ing 64-bit platforms), the system firmware is located on a flash memory in 
the Serial Peripheral Interface (SPI) bus Ө, which is physically connected 
to the PCH. The SPI flash constitutes the main target for forensic analysis 
because it stores the firmware we want to analyze. 
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Figure 19-1: A block diagram of a modern Intel chipset 


The motherboard of a PC typically has one discrete physical SPI flash 
chip soldered onto it, but you might occasionally encounter systems with 
multiple SPI flash chips. This happens when a single chip doesn't have 
enough capacity to store all the system firmware; in that case, the platform 
vendor uses two chips. We discuss this situation later in this chapter, in 
"Locating the SPI Flash Memory Chip" on page 376. 


DUALBIOS TECHNOLOGY 


DualBIOS technology also uses multiple SPI flash chips on the motherboard of 
a computer. But unlike the approach just discussed, where multiple SPI flash 
chips store a single firmware image, DualBIOS technology uses multiple chips 
to store different firmware images or multiples of the same firmware image. This 
technology provides additional protection against firmware corruption, because 


if the firmware in one chip is corrupted, the system could boot from a second 
chip containing an identical firmware image. 





To acquire the firmware image stored on the SPI flash, you need to be 
able to read the contents of the flash. Generally speaking, you can read the 
firmware using either a software or a hardware approach. In the software 
approach, you attempt to read the firmware image by communicating with 


the SPI controller using software running on the host CPU. In the hardware 
approach, you physically attach a special device called an SPI programmer 
to the SPI flash, then read the firmware image directly from the SPI flash. 
We'll cover both approaches, starting with the software method. 

Before we go into the description of the software approach, however, you 
should understand that each approach has its advantages and limitations. 
One of the benefits of dumping UEFI firmware using the software method 
is that you can do it remotely. A user of the target system can run an applica- 
tion to dump the contents of the SPI flash and send it to a forensic analyst. 
But this approach also has a major drawback: if an attacker has already com- 
promised the system firmware, he or she could interfere with the process of 
firmware acquisition by forging the data read from the SPI flash. This makes 
the software approach somewhat unreliable. 

The hardware approach doesn't have the same drawback. Even though 
you must be physically present and it requires you to open the target sys- 
tem's chassis, this method directly reads the contents of the powered-off 
system's SPI flash without giving the attacker any opportunity to counterfeit 
the data (unless you're dealing with a hardware implant, which we don't 
cover in this book). 


The Software Approach to Firmware Acquisition 


In the software approach to dumping UEFI firmware from the target sys- 
tem, you read the contents of the SPI flash from the operating system. You 
can access modern systems' SPI controllers through registers in the PCT 
configuration space (a block of registers that specify device configuration on 
the PCI bus). These registers are memory mapped, and you can read and 
write to them using regular memory read and write operations. In this 
section, we’ll demonstrate how to locate these registers and communicate 
with the SPI controller. 

Before we proceed, you should know that the location of an SPI regis- 
ter is chipset specific, so in order to communicate with an SPI controller, 
we need to refer to the chipset dedicated to the platform we’re targeting. 
In this chapter, we’ll demonstrate how to read the SPI flash on chipsets in 
Intel’s 200 Series (the location of SPI registers can be found at Attps://www 
intel.com/content/www/us/en/chipsets/200-series-chipset-pch-datasheet-vol-2.html), 
which are the latest chipsets for desktop systems at the time of this writing. 

It’s also worth mentioning that the memory locations that correspond 
to the registers exposed via the PCI configuration space are mapped in the 
kernel-mode address space and, as a result, aren’t accessible to code run- 
ning in the user-mode address space. You would need to develop a kernel- 
mode driver to access the address range. The Chipsec tool discussed later 
in this chapter provides its own kernel-mode driver for accessing the PCI 
configuration space. 
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locating PCl Configuration Space Registers 


First we need to locate the memory range where the SPI controller's reg- 
isters are mapped. This memory range is called the Root Complex Register 
Block (RCRB). At offset 3800h in the RCRB, you'll find the SPI Base Address 
Register (SPIBA К), which holds the base address of memory-mapped SPI 
registers (see Figure 19-2). 


System memory 





Root Complex SPI 


Register Block memory-mapped 
registers 


METTE 


SPIBAR 
FDATA16 
ЕКЕС1 


Figure 19-2: The location of SPI control and status registers in system memory 
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PCIE BUS 


The PCI Express (PCle) bus is a high-speed serial bus standard used on virtually 
all modern PCs across different market segments: consumer laptops and desk- 
tops, data center servers, and so on. The PCle bus serves as an interconnection 
between various components and peripheral devices in the computer. Many 


integrated chipset devices (SPI flash, memory controller, and so forth) are repre- 


sented as PCle endpoints on the bus. 





The RCRB address is stored in the Root Complex Base Address (RCBA) 
PCI register, which is located on bus 0, device 31h, function 0. This is a 
32-bit register, and the address of the RCRB is provided in bits 31:14. We 
assume that the lower 14 bits of the RCRB’s address are zeros, since RCRB 
is aligned at the boundary of 16Kb. Once we get the RCRB’s address, we 
can obtain the SPIBAR value by reading memory at the 3800h offset. In 
the next section, we discuss the SPI registers in more detail. 


SPI FLASH FIRMWARE 


The SPI flash contains not only BIOS firmware but also other types of platform 
firmware, like Intel ME (Manageability Engine], Ethernet controller firmware, 


and vendor-specific firmware and data. The various types of firmware differ in 


their locations and access control permissions. For instance, the host OS can't 
access Intel ME firmware, so the software approach for acquiring firmware 
won't work for Intel ME. 





Calculating SPI Configuration Register Addresses 


Once we've obtained the SPIBAR value, which provides us with the location 
of the SPI registers in memory, we can program the registers to read the con- 
tents of an SPI flash. The offsets of the SPI registers may vary depending on 
the platform, so the best way to determine the actual values for a given hard- 
ware configuration is to look up the values in the platform chipset documen- 
tation. For instance, for platforms supporting Intel's latest CPU at the time of 
this writing (Kaby Lake), we can consult the Intel 200 Series Chipset Family 
Platform Controller Hub datasheet to find the location of the SPI memory- 
mapped registers. The information is in the section called “Serial Peripheral 
Interface." For each SPI register, the datasheet provides its offset from the 
SPIBAR value, register name, and the register default value at the platform 
reset. We'll use this datasheet as a reference in this section to determine the 
addresses of the SPI registers we're interested in. 


Using the SPI Registers 

Now that you know how to find the addresses of SPI registers, you can figure 
out which one you'll use to read the contents of the SPI flash. Table 19-1 lists 
all the registers we'll need to obtain an image of the SPI flash. 

Table 19-1: SPI Registers for Firmware Acquisition 


Offset from SPIBAR Register name Register description 


O4h-O5h HSFS Hardware sequencing flash status 
O6h-07h HSFC Hardware sequencing flash control register 
O8h-OBh FADDR Flash address 

10h-4Fh FDATAX Array of flash data 

58h-5Bh FREGI Flash region 1 (BIOS descriptor) 


We'll discuss each of these registers in the following sections. 
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The FREGI Register 


The register we'll start with is flash region 1 (FREGI). It provides the location 
of the BIOS region on the SPI flash. The layout of this 32-bit-length register 
is presented in Figure 19-3. 


e ЕГЕ ө ; 
Reserved Region Limit Reserved Region Base 


32 28 16 12 0 


Figure 19-3: The layout of FREG] SPI register 


The Region Base field provides 24:12 bits of the base address for the 
BIOS region in the SPI flash. Since the BIOS region is aligned at 4Kb, the 
lowest 12 bits of the region's base address start at 0. The Region Limit field Ө 
provides 24:12 bits for the BIOS region in the SPI flash. For instance, if the 
Region Base field contains a value of 0xaaa and Region Limit contains a 
value of Oxbbb, then the BIOS regions spans from 0xaaa000 to Oxbbbfff on 
the SPI flash. 


The HSFC Register 


The hardware sequencing flash control (HSFC) register allows us to send 
commands to the SPI controller. (In the specification, these commands 
are referred to as cycles.) You can see the layout of the HSFC register in 
Figure 19-4. 


ө e e o 
FSMIE | Reserved FDBC Reserved FCYCLE FGO 
16 15 14 8 3 1 0 


Figure 19-4: The layout of HSFC SPI register 


We use the HSFC register to send a read/write/delete cycle to the SPI 
flash. The 2-bit FCYCLE field Ө encodes the operation to perform the 
following: 


00 Read a block of data from the SPI flash 

01 Write a block of data to the SPI flash 

11 Erase a block of data on the SPI flash 

10 Reserved 

For read and write cycles, the FDBC field Ө indicates the number of 
bytes that should be transferred to and from the SPI flash. The content of 
this field is zero based; a value of 000000b represents 1 byte, and a value of 
111111Ь represents 64 bytes. As a result, the number of bytes to transfer is 
the value of this field plus 1. 


The FGO field Ө is used to initiate the SPI flash operation. When the 
value of this field is 1b, the SPI controller will read, write, and erase the data 


based on the values written to the FCYCLE and FDBC fields. Before setting 
the FGO field, the software needs to have specified all the registers that indi- 
cate the type of the operation, the amount of data, and the SPI flash address. 

The final HSFC field that deserves our attention is flash SPI SMI# enable 
(FSMIE) Ө. When this field is set, the chipset generates a System Management 
Interrupt (SMI), which leads to the execution of the SMM code. As we'll see 
in “Considering the Drawbacks of the Software Approach" on page 373, you 
could use FSMIE to counteract the firmware image acquisition. 


COMMUNICATING WITH THE SPI CONTROLLER 


Using the HSFC register isn't the only way to send commands to the SPI con- 
troller. Generally, there are two ways to communicate with the SPI flash: hard- 
ware sequencing and software sequencing. With the hardware-sequencing 
method we're showing here, we let the hardware pick the SPI commands that 
get sent for read/write operations (which is exactly what the HSFC register is 
used for). Software sequencing offers us more power to choose which specific 
commands get sent to read/write operations. In this section, we use hardware 
sequencing through the HSFC register because it's easy and it provides us with 


the functionality we need to read the BIOS firmware. 





The FADDR Register 


We use the flash address (FADDR) register to specify the SPI flash linear 
address for read, write, and erase operations. This register is 32 bits, but 
we use only the lower 24 bits to specify a linear address for the operation. 
The upper 8 bits of this register are reserved and unused. 


The HSFS Register 


Once we've initiated the SPI cycle by setting the FGO field of the HSFC 
register, we can determine when the cycle has finished by looking at the 
hardware sequencing flash status (HSFS) register. This register is composed 
of multiple fields that provide information on the status of the requested 
operation. In Table 19-2, you can see the HSFS fields used to read the SPI 
image. 


Table 19-2: The SPI Register HSFS Fields 


Field offset Field size Field name Field description 
Oh 1 FDONE Flash cycle done 
1h 1 FCERR Flash cycle error 
2h 1 AEL Access error log 
5h 1 SCIP SPI cycle in progress 
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Write size of data to read to HSFC 


Write read command to HSFC 


Set FGO (0x0001) bit in HSFC 


Wait for SPI read cycle completion 


Read data from FDATAX registers 


The FDONE bit is set by the chipset when the previous flash cycle (initi- 
ated by the HSFC register's FGO field) is complete. The FCERR and AEL 
bits indicate that an error has occurred during the SPI flash cycle and that 
the returned data may not contain valid values, respectively. The SCIP bit 
indicates that the flash cycle is in progress. We set the SCIP by setting the 
FGO bit, and the SCIP clears when the value of FDONE is 1. Based on this 
information, we can determine that the operation we initiated has com- 
pleted successfully when the following expression is true: 


(FDONE == 1) 88 (FCERR == 0) 88 (AEL == 0) 88 (SCIP == 0) 





The FDATAX Registers 


The array of flash data (FDATAX) registers hold the data to be read from 

or written to the SPI flash. Each register is 32 bits, and the total number 
of FDATAX registers in use depends on the amount of bytes to transfer, 
which is specified in the HSFC register's FDBC field. 


Reading Data from the SPI Flash 


Now let's put together all this information and see how to read data from 
the SPI flash using these registers. First, we locate the Root Complex 
Registers Block, from which we can determine the base address of SPI 
memory-mapped registers and get access to those registers. By reading the 
FREGI SPI register, we can determine the location of the BIOS region on 
the flash—that is, the BIOS starting address and BIOS limit. 

Next, we read the BIOS region using the SPI registers just described. 
This step is demonstrated in Figure 19-5. 
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Figure 19-5: Reading data from the SPI flash 
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First, we set FADDR to the linear address of the flash memory region 
that we want to read Ө. Then we specify the total number of bytes to read 
from flash memory by setting the FDBC field Ө of the flash control register. 
(A value of 111111b would read 64 bytes per cycle.) Next we set the FCYCLE 
field Ө with the 00b value, which indicates the read cycle and sets the FGO 
bit O that starts our flash reading operation. 

Once we set the FGO bit, we need to monitor the flash status register 
to know when the operation is complete. We can do this by checking the 
FDONE, FCERR, AEL, and SCIP fields Ө. Once the read operation is fin- 
ished, we read flash data from the FDATAX registers Ө. The FDATAX[1] 
register provides us with the first 4 bytes of flash memory at the target 
address specified in the FADDR register; ЕОАТАХ [2] provides us with the 
second 4 bytes of flash memory, and so on. By repeating these steps and 
incrementing the FADDR value by 64 bytes in each iteration, we read the 
whole BIOS region from the SPI flash. 


Considering the Drawbacks of the Software Approach 


The software approach to BIOS firmware dumping is convenient because it 
doesn't require you to be physically present; with this method, you can read 
the contents of the SPI flash remotely. But it isn't robust against an attacker 
who has already compromised the system firmware and can execute mali- 
cious code in SMM. 

As we've noted, the HSFC register has an FSMIE bit that triggers an SMI 
when the flash cycle completes. If an attacker has already compromised SMM 
and is able to set the FSMIE bit before the firmware acquisition software sets 
the FGO bit, then the attacker will receive control once the SMI is generated 
and will be able to modify the contents of the FDATAX registers. As a result, 
the firmware acquisition software will read forged values from FDATAX and 
won't be able to get an original image of the BIOS region. Figure 19-6 dem- 
onstrates this attack. 
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Write read command to HSFC 
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Figure 19-6: Subverting a software BIOS acquisition via SMI 
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Before the reader sets the FGO bit Ө in the flash control register, the 
attacker writes 1 to the register's FSMIE bit Ө. Once the cycle is finished 
and data is written back to the FDATAX registers, an SMI is triggered and 
the attacker receives control 6. Then the attacker modifies the contents 
of the FDATAX registers O to conceal the attack on the BIOS firmware. 
After regaining control, the reader will receive fake data 9 and won't 
detect the compromised firmware. 

This attack demonstrates that the software approach doesn't provide 
a 100 percent reliable solution for firmware acquisition. In the following 
section, we'll discuss the hardware approach to obtaining system firmware 
for forensic analysis. Conducting forensic analysis by physically attaching 
a device to the SPI flash avoids the possibility of the attack depicted in 
Figure 19-6. 


The Hardware Approach to Firmware Acquisition 


Chapter 19 


To guarantee we have acquired the actual BIOS image stored on the SPI 
flash and not one already compromised by an attacker, we can use the 
hardware approach. With this approach, we physically attach a device to 
the SPI flash memory and read its contents directly. This is the best solu- 
tion because it's more trustworthy than the software approach. As an extra 
benefit, this approach allows us to obtain other firmware stored on the SPI 
flash, like ME and GBE firmware, which might not be accessible with the 
software approach due to restrictions enforced by the SPI controller. 

The SPI bus on modern systems allows multiple masters to communi- 
cate with the SPI flash. For instance, on systems based on the Intel chipset, 
there are generally three masters: the host CPU, the Intel ME, and GBE. 
These three masters have different access rights to different regions of the 
SPI flash. On most modern platforms, the host CPU can't read and write to 
the SPI flash region containing the Intel ME and GBE firmware. 

Figure 19-7 demonstrates a typical setup for obtaining the BIOS firm- 
ware image by reading the SPI flash. 


Host interface 


(USB 2.0, UART, 


SPI flash with i SPI апо эе an) Host 
firmware programmer platform 


Figure 19-7: A typical setup for dumping the SPI flash image 


In order to read data from the flash memory, we need an additional 
device, called an SPI programmer, which we physically attach to the SPI flash 
memory chip on the target system. We also connect the SPI programmer via 
a USB or UART interface to a host that we use to obtain the BIOS firmware 
image. We would then run some particular software on the programmer 
to make it read data from the flash memory chip and transfer the data to 
the analyst's computer. This might be proprietary software provided with 


a particular SPI programmer, or it could be an open source solution such 
as the Flashrom tool, which is discussed later in “Reading the SPI Flash 
with the FT2232 Mini Module" on page 377. 


Reviewing a Lenovo ThinkPad T540p Case Study 


The hardware approach is even more specific than the software approach. 
It requires you to consult platform documentation in order to learn what 
kind of flash memory the platform uses to store the firmware and where the 
firmware is physically located in the system. In addition, there are numer- 
ous flash programming devices for specific hardware we could use to read 
the contents of the flash memory. We won't discuss the various hardware 
and software options available for system firmware acquisition, because 
there are simply too many. Instead, we'll go over one of the possible ways to 
dump firmware from the Lenovo ThinkPad T540p using the FT2232 SPI 
programmer. 

We chose this SPI programmer because of its relatively low price (about 
$30) and flexibility, as well as our prior experience of working with it. As we've 
mentioned, there are many solutions, and each has its unique features, advan- 
tages, and drawbacks. 


DEDIPROG SF100 ISP IC PROGRAMMER 


Another device we'd like to mention is the Dediprog SF100 ISP IC Programmer 
(shown in Figure 19-8). It's popular in the security research community, supports 
many SPI flashes, and offers extensive functionality. Minnowboard, an open 
source reference board for hardware and firmware developers, has a good 


tutorial on using Dediprog for updating firmware at hitps://minnowboard.org/ 


tutorials/updating-firmware-via-spi-flash-programmer/. 


av Gediprog com 


Figure 19-8: A Dediprog SF100 ISP IC Programmer 
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locating the SPI Flash Memory Chip 


Let's start by physically reading the firmware image from the Lenovo 
ThinkPad T540p platform. First, to dump the system firmware from 

the target system, we need to find where, on the main board, the SPI 
flash memory chips are located. To do this, we consulted the Hardware 
Maintenance Manual (Attps://thinkpads.com/support/hmm/hmm, pdf/t540p 
10540 hmm, en sp40a26003 Ol.pdf) for this laptop model and took apart 
the target system's hardware. In Figures 19-9 and 19-10, you can see the 
locations of the two flash memory chips. Figure 19-9 shows a complete 
image of the system board. The SPI flash chips are located in the high- 
lighted area. 


Don't repeat the actions described in this section unless you are 100 percent sure of 
what you're doing. An invalid or incorrect configuration of the tools may brick the 
target system. 





Figure 19-9: The Lenovo ThinkPad T540p mainboard with SPI flash modules 


Figure 19-10 zooms in on the region highlighted in Figure 19-9 so you 
can see the SPI flash chips more clearly. This laptop model uses two SOIC-8 
flash memory modules to store the firmware—a 64Mb (8MB) one and a 
32Mb (4MB) one. This is a very popular solution on many modern desktops 
and laptops. 


SPI flash chip #1 





ү; 5мн2 ‘ve " SPI flash chip #2 
Figure 19-10: The location of the SPI flash modules on the mainboard of the laptop 


Since two separate chips are used to store the system firmware, we'll 
need to dump the contents of both. We'll obtain the final firmware image by 
concatenating the images from the two flash memory chips into a single file. 


Reading the SPI Flash with the FT2232 Mini Module 


Once we've identified the physical location of the chips, we can connect 

the SPI programmer's pins to the flash module on the system board. The 
datasheet (Attp://wwu.ftdichip.com/Support/Documents/DataSheets/Modules/DS 
_FT2232H_Mini_Module.pdf) for the FT2232H Mini Module shows us which 
pins we should use to attach the device to the memory chip. Figure 19-11 
demonstrates the layout of the pins for both the FT2232H Mini Module and 
the SPI flash chip. 

The FT2232H has two sets of pins, corresponding to two channels: 
Channel 2 and Channel 3. You may use either channel to read the con- 
tents of the SPI flash memory. In our experiment, we use Channel 3 to 
attach the FT2232H to the SPI memory chip. Figure 19-11 shows which 
of the FT2232H pins we connected to the corresponding pins of the SPI 
flash memory chip. 

In addition to connecting the FT2232H to the memory chip, we need 
to configure it to operate in USB bus-powered mode. The FT2232H Mini 
Module supports two modes of operating: USB bus-powered and self-powered. 
In the bus-powered mode, the mini module takes power from the USB bus 
it is attached to, and in self-powered mode, the power is provided indepen- 
dently of the USB bus connection. 
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Figure 19-11: The layout of the pins for the FT2232H Mini Module and SPI flash chip 


To help us attach our SPI programmer to the SPI chip module, we use 
a SOIC-8 clip, as shown in Figure 19-12. This clip allows us to easily connect 
the mini module's pins to the corresponding pins of the flash memory chip. 





Figure 19-12: Attaching the FT2232H Mini Module to the SPI flash chip 
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Once we connect all the components, we can read the contents of the 
SPI flash chip. To do this, we use an open source tool called Flashrom (https:// 
www.flashrom.org/Flashrom). This tool was developed specifically for identify- 
ing, reading, writing, verifying, and erasing flash chips. It supports a large 
number of flash chips and works with many different SPI programmers, 
including the FT2232H Mini Module. 

Listing 19-1 shows the results of running Flashrom to read the contents 
of both SPI flash chips on the Lenovo ThinkPad T540p platform. 





user@host: flashrom -p ft2232 spi:type-2232H,port-B --read dump 1.bin 
flashrom v0.9.9-r1955 on Linux 4.8.0-36-generic (x86 64) 
flashrom is free software, get the source code at https://flashrom.org 


Calibrating delay loop... OK. 

Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E /MX25L6473E" 
(8192 kB, SPI) on ft2232 spi. 

Reading flash... done. 


user@host: flashrom -p ft2232 spi:type-2232H,port-B --read dump 2.bin 
flashrom v0.9.9-r1955 on Linux 4.8.0-36-generic (x86 64) 
flashrom is free software, get the source code at https://flashrom.org 


Calibrating delay loop... OK. 
Found Macronix flash chip "MX25L3273E" (4096 kB, SPI) on ft2232 spi. 
Reading flash... done. 


user@host: cat dump 2.bin >> dump 1.bin 





Listing 19-1: Dumping SPI flash images with the Flashrom tool 


First, we run Flashrom to dump the contents of the first SPI flash chip, 
passing it a programmer type and port number as parameters Ө. The type 
we specify, 2232H, corresponds to our FT2232H Mini Module, and port B 
corresponds to Channel 3, the one we're using to connect to the SPI flash 
chip. The --read parameter tells Flashrom to read the contents of the SPI 
flash memory into the dump 1.bin file. Once we run the tool, it displays the 
type of the detected SPI flash chip—in our case, Macronix MX25L6473E Ө. 
Once Flashrom finishes reading the flash memory, it outputs a confirma- 
tion 6. 

After reading the first flash chip, we reconnect the clip to the second 
chip and run Flashrom again to dump the second chip's contents into the 
dump. 2.bin file. Once this operation is done, we create a complete image of 
the firmware by concatenating the two dumped images Ө. 

We have now dumped a complete, trustworthy image of the firmware. 
Even if the BIOS is already infected and an attacker attempts to thwart our 
firmware acquisition, we'll still obtain the actual firmware code and data. 
Next, we'll analyze it. 
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Analyzing the Firmware Image with UEFITool 
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Once we obtain a firmware image from the target system's SPI flash, we 
can analyze it. In this section, we'll cover the basic components of platform 
firmware, such as firmware volumes, volume files, and the sections neces- 
sary for understanding the layout of the UEFI firmware in the flash image. 
Then we'll focus on the most important steps in the forensic analysis of 
firmware. 


In this section, we'll provide high-level descriptions rather than detailed definitions 
of the data structures used, since this is too large a subject and in-depth coverage is 
beyond the scope of this chapter. We will, however, provide references to documenta- 
tion containing definitions and the layout of the data structures if youd like further 
information. 


We're going to revisit UEFITool (https://github.com/LongSoft/UEFITool/) 
the open source tool for parsing, extracting, and modifying UEFI firmware 
images that was introduced in Chapter 15, to demonstrate theoretical con- 
cepts with the real firmware image we acquired in the previous section. The 
ability to look inside the firmware image to browse and extract various com- 
ponents is incredibly useful for forensic analysis. This tool doesn't require 
installation; once downloaded, the application is ready to be executed. 


Getting to Know the SPI Flash Regions 


Before we look at the firmware image, we need to go over how the infor- 
mation stored on the SPI flash is organized. Generally, modern platforms 
based on the Intel chipset SPI flash consist of several regions. Fach region 
is dedicated to storing firmware for a specific device available in the plat- 
form; for instance, UEFI BIOS firmware, Intel ME firmware, and Intel GBE 
(integrated LAN device) firmware are each stored in their own region. 
Figure 19-13 demonstrates the layout of several regions of the SPI flash. 


SPI flash regions 






Descriptor region 


GbE region Й 


МЕ гедіоп 


Platform data 
region 













BIOS region 





Figure 19-13: Regions of the SPI flash image 


The SPI flash in modern systems supports up to six regions, including 
the descriptor region, where flash images always start. The descriptor region 
contains information about the SPI flash's layout; that is, it provides the chip- 
set with information about the other regions present on the SPI flash, such 
as their location and access rights. The descriptor region also dictates the 
access rights of each master in the system that can communicate with the SPI 
flash controller. Multiple masters are able to communicate with the controller 
at the same time. We can find the complete layout of the descriptor region, 
including definitions of all the data structures located in it, in the chipset 
specification for the target platform. 

In this chapter, we're primarily interested in the BIOS region, which 
contains firmware executed by the CPU at the reset vector. We can extract 
the location of the BIOS region from the descriptor region. Normally, BIOS 
is the last region on the SPI flash, and it constitutes the main target for 
forensic analysis. 

Let's take a look at the different regions of the SPI image that we 
acquired with the hardware approach. 


Viewing SPI Flash Regions with UEFITool 


First, launch UEFITool and select File > Open image file. Then select the 
file with the SPI image you want to analyze—we’ve supplied one you can 
use with the book's resources at Attps://nostarch.com/rootkits/. Figure 19-14 
shows the result of this operation. 
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Figure 19-14: Browsing SPI flash regions in UEFITool 
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When the firmware image loads, UEFITool automatically parses it 
and provides this information in a tree-like structure. In Figure 19-14, the 
tool identified that the firmware image is from a system based on the Intel 
chipset Ө with only four SPI regions: descriptor, ME, GbE, and BIOS. If 
we select the BIOS region in the Structure window, we can see information 
about it in the Information window. UEFITool shows the following items 
describing the region: 


Offset Ө The offset of the region from the beginning of the SPI flash 
image 
Fullsize Ө The size of the region in bytes 


Memory address Ө The address of the region mapped into the 
physical memory 


Compressed Ө Whether the region contains compressed data 
The tool provides a convenient method for extracting individual regions 


(and any other object shown in the structure window) from the SPI image 
and saving them in a separate file, as shown in Figure 19-15. 
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Figure 19-15: Extracting a BIOS region and saving it as a separate file 


To extract and save a region, right-click the region and select Extract 
asis...in the context menu. The tool will then show a regular dialog that 
lets you choose where you want to save your new file. Once you've done this, 
check the location you chose to confirm that the operation was successful. 
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Analyzing the BIOS Region 


Once we've identified the location of the BIOS region, we can proceed 
with our analysis. At a high level, the BIOS region is organized into firm- 
ware volumes, which are basic storage repositories for data and code. The 
exact definition of the firmware volume is provided in the EFI Firmware 
Volume Specification (https://www.intel.com/content/www/us/en/architecture 
-and-technology/unified-extensible-firmware-interface/efi-firmware-file-volume 
-specification.himl). Every volume starts with a header that provides the 
necessary volume attributes, such as the type of the volume filesystem, 
the volume size, and the checksum. 

Let’s examine the firmware volumes available in the BIOS we’ve 
acquired. If we double-left-click the BIOS region in the UEFITool win- 
dow (as in Figure 19-15), we get a list of firmware volumes available, as 
shown in Figure 19-16. 





© UEFIToo! NE alpha 40 - dmp.rom = D x 
File Action Help 
Structure Information 
Nome Action Type Subtype Offset: 800000n @Ў 
ZeroVector: 

м 

ГА пены аг | |00 a0 oa ю 00 o0 oo 

Р є м d өө өө eo ee ee eo өө өө 

GbE region Region GbE Signature: _FVH 

ME region Region ME FileSystem GUID: 

У BIOS region Region BIOS 7A935409 0468 -444A-81CE -08ғ61708900ғ © 
Padding Padding Empty (OxFF) Full size: 2ВӨӨӨӨһ (2818048) 
EfiFirewareFileSystemGuid Volume FFSv2 Header size: 48h (72) 

Padding Padding Non-empty Body size: 2AFFB8h (2817976) Ө 
EfiSystenlivDataFvGuid Volume  NVRAM Revision: 2 

00504624 -8A59-4EEB -BDOF -6836E96128E0 Volume НУРАМ анана 
EfiFirewareFileSystemGuid Volume FFSv2 rese polarity: 


Checksum: С804һ, valid 
Header memory address: FFCOO000h 
Data memory address: FFCOO048h 
Compressed: No 

Fixed: Yes 


Parser FIT Search Builder 








Figure 19-16: Browsing the firmware volumes available in the BIOS region 


There are four firmware volumes available in our BIOS region, and 
you'll also notice two regions marked Padding. The padding regions don’t 
belong to any of the firmware volumes but rather represent empty space 
between them, filled with either 0x00 or Oxff values depending on the erase 
polarity of the SPI flash. Erase polarity determines values written to flash 
memory for erase operation. If erase polarity is 1, then erased bytes of the 
flash memory are set to the values of Oxff; if erase polarity is 0, then erased 
bytes are set to 0x00. As a result, when erase polarity is 1, the padding 
regions (the empty space) consists of Oxff values. 
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In the information tab to the right of the volumes in Figure 19-16, we 
can see the attributes of the selected volume. Here are some of the impor- 
tant fields: 


Offset Ө The offset of the firmware volume from the beginning of 
the SPI image. 


Signature Ө The signature of the firmware volume in the header. 
This field is used to identify volumes in the BIOS regions. 


Filesystem GUID Ө The identifier of the filesystem used in the 
firmware volume. This Globally Unique Identifier (GUID) is dis- 
played as the name of the volume in the structure window. If the 
GUID is documented, UEFITool displays its human-readable name 
(such as Et FirmwareFileSystemGuid in Figure 19-16) instead of the 
hexadecimal value. 


Headersize Ө The size of the firmware volume header. The volume 
data follows the header. 


Body size Ө Тһе size of the firmware volume body—that is, the size 
of the data stored in the volume. 


Getting to Know the Firmware Filesystem 


The firmware volumes are organized as a filesystem, the type of which 

is indicated in a filesystem GUID in the firmware header. The filesystem 
most frequently used in firmware volumes is the firmware filesystem (FFS), 
defined in the EFI FFS specification, but firmware volumes also use other 
filesystems, such as FAT32 or NTFS. We'll focus ор the FFS as it is the most 
common. 

The FFS stores all the files in the root directory and contains no provi- 
sion for any directory hierarchy. According to the EFI FFS specification, 
each file has an associated type, located in that file's header, that describes 
the data stored in that file. Here is a list of some frequently encountered file 
types that may be useful in forensic analysis: 


EFI FV FILETYPE RAW А гам file—no assumptions should be made 
about the data stored in the file. 

EFI ЕУ FILETYPE FIRMWARE VOLUME IMAGE А file that con- 
tains an encapsulated firmware volume. Even though FFS has no 
provision for directory hierarchy, we can use this file type to create 

a tree-like structure by encapsulating firmware modules in files. 

EFI FV FILETYPE SECURITY CORE A file with code and data that 
is executed at the Security (SEC) phase of the boot process. The SEC 
phase is the very first phase of the UEFI boot process. 

EFI FV FILETYPE PEI CORE An executable file that initiates the 
Pre-EFI Initialization (PEI) phase of the boot process. The PEI phase 
follows the SEC phase. 

EFI FV FILETYPE PEIM The PEI modules, which are files with code 
and data executed at the PEI phase. 


EFI FV FILETYPE DXE CORE Ап executable file that initiates the 
Driver Execution Environment (DXE) phase of the boot process. The DXE 
phase follows the PEI phase. 

EFI FV FILETYPE DRIVER Ап executable file launched at the DXE 
phase. 

EFI ЕУ FILETYPE COMBINED PEIM DRIVER А file with code and 
data that can be executed at both the PEI and DXE phases. 

EFI FV FILETYPE APPLICATION А AUEFI application, which is an 
executable that can be launched at the DXE phase. 


EFI ЕУ FILETYPE FFS PAD А padding file. 


Unlike the typical filesystems used in operating systems, where files 
have human-readable filenames, FFS files are identified by GUIDs. 


Getting to Know File Sections 


Most firmware files stored in the FFS consist of a single part or multiple dis- 
crete parts, called sections (although some files, such as EF] РУ FILETYPE 
_RAW files, don’t contain any sections). 

There are two types of sections: leaf sections and encapsulation sec- 
tions. Leaf sections directly contain data, the type of which is determined 
by a section type attribute in the section header. Encapsulation sections con- 
tain file sections, which may contain either leaf sections or encapsulation 
sections. This means that one encapsulation section can contain a nested 
encapsulation section. 

The following list describes some types of leaf sections: 


EFI SECTION PE32 Contains a PE image. 
EFI SECTION PIC Contains position-independent code (PIC). 
EFI SECTION TE Contains a Terse Executable (TE) image. 


EFI_SECTION_USER_INTERFACE Contains a user interface string. It 
is typically used to store a human-readable name for the file, in addi- 
tion to the file GUID. 


EFI_SECTION_FIRMWARE_VOLUME_IMAGE Contains an encapsu- 
lated firmware image. 


And here are a couple of the encapsulation sections defined in the FFS 
specification: 


EFI_SECTION_COMPRESSION Contains compressed file sections. 


EFI_SECTION_GUID_DEFINED  Encapsulates other sections with 
respect to an algorithm that is identified by the section GUID. This 
type is used for signed sections, for example. 


These objects constitute the contents of the UEFI firmware on modern 
platforms. A forensic analyst must account for every component of the firm- 
ware, whether it is a section with executable code, like PE32, TE or PIC, ora 
data file with nonvolatile variables. 
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To better understand the concepts presented here, see Figure 19-17, 
which demonstrates the location of the CpuInitDxe driver in the firmware 
volume. This driver is responsible for CPU initialization at the DXE phase. 
We'll go from the bottom to the top in the FFS hierarchy in order to 
describe its location in the firmware image. 
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Figure 19-17: The location of the CpuInitDxe driver in the BIOS region 


The driver's executable image is located in the PE32 image section 9. 
This section, along with other sections that contain the driver name Ө, 
version Ө, and dependencies Ө, are located in the file with the GUID 
(62D171CB-78CD-4480-8678-C6A2A797A8DE) Ө. The file is part of the encapsu- 
lated firmware volume Ө stored in the compressed section Ө. The com- 
pressed section is located in the (9E21FD93-9C72-4C15-8C4B-E77F1DB2D792] 
file Ө of the firmware volume image type, which is stored in the top-level 
firmware volume Ө. 

This example is primarily intended to demonstrate the hierarchy of 
objects that constitute the UEFI firmware, but this is just one possible 
approach to parsing it. 

Now that we know how the BIOS region is organized, we'll be able to 
navigate its hierarchy and search for various objects stored in the BIOS 
firmware. 


Analyzing the Firmware Image with Chipsec 
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In this section, we'll discuss firmware forensic analysis with the platform 
security assessment framework Chipsec (https://github.com/chipsec/), intro- 
duced in Chapter 15. In this section, we'll explore the tool's architecture in 
more detail; then, we'll analyze some firmware, providing a few examples 
that demonstrate Chipsec's functionality and utility. 


The tool provides a number of interfaces for accessing platform hard- 
ware resources, like physical memory, PCI registers, NVRAM variables, and 
the SPI flash. These interfaces are very useful to forensic analysts, and we'll 
look at them more seriously later in this section. 

Follow the installation guide in the Chipsec manual (Attps://github.com/ 
chipsec/chipsec/blob/master/chipsec-manual.pdf) to install and set up the tool. 
The manual also covers a multitude of functionality that you can use, but in 
this section, we're focusing only on Chipsec’s forensic analysis capabilities. 


Getting to Know the Chipsec Architecture 
Figure 19-18 shows the tool's high-level architecture. 
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application 
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Figure 19-18: The Chipsec tool's architecture 





At the bottom, we can see modules that provide access to system 
resources, such as memory-mapped IO address ranges, PCI configuration 
space registers, and physical memory. These are platform-dependent mod- 
ules implemented as kernel-mode drivers and EFI native code. (Currently, 
Chipsec provides kernel-mode drivers for Windows, Linux, and macOS.) 
Most of the modules are written in C and are intended to execute in kernel 
mode or in the EFI shell. 


The UEFI Shell is a UEFI application that provides a command line interface for 
firmware, allowing us to launch UEFI applications and execute commands. We can 
use the UEFI Shell to retrieve information on the platform, view and modify boot 
manager variables, load UEFI drivers, and more. 


On top of these low-level OS-dependent components is an OS- 
independent abstraction layer called OS Helper, comprising a number 
of modules that hide an OS-specific API for communicating with kernel- 
mode components from the rest of the application. The modules located 
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at this level are implemented in Python. At the bottom, these modules 
interface with the kernel-mode components; at the top, they provide an 
OS-independent interface for another component, the hardware abstrac- 
tion layer (HAL). 

The HAL further abstracts the platform’s low-level concepts, like the PCI 
configuration registers and model-specific registers (MSRs), and it provides 
an interface for the Chipsec components located at the levels immediately 
above it: Chipsec Main and Chipsec Util. The HAL is also written in Python and 
relies on OSHelper to access the platform-specific hardware resources. 

The two remaining components, located at the top of the architecture, 
provide the main functionality available to users. The first interface, Chipsec 
Main, is available through the chipsec_main.py Python script in the tool’s root 
folder. It allows us to execute tests that check the security configuration of 
certain platform aspects, run PoCs to test for the presence of vulnerabilities 
in system firmware, and more. The second interface, Chipsec Util, is avail- 
able through the chipsec util.py script. We can use it to run individual com- 
mands and access platform hardware resources to read the SPI flash image, 
dump the UEFI NVRAM variables, and so on. 

We're primarily interested in the Chipsec Util interface because it pro- 
vides rich functionality for working with UEFI firmware. 


Analyzing Firmware with Chipsec Util 


You can find out the commands provided by Chipsec Util by running the 
chipsec_util.py script, located in the root directory of the tool's repository, 
without specifying any arguments. Generally, commands are grouped into 
modules based on the platform hardware resources they work with. Here 
are some of the most useful modules: 


acpi Implements commands for working with Advanced Configuration 
and Power Interface tables. 


сри Implements commands related to the CPU, such as reading con- 
figuration registers and obtaining information about the CPU. 


spi Implements a number of commands for working with the SPI flash, 
like reading, writing, and erasing data. There is also an option for dis- 
abling BIOS write protection on systems with unlocked write protection 
(as discussed in Chapter 16). 


uefi Implements commands for parsing UEFI firmware (the SPI flash 
BIOS region) to extract executables, NVRAM variables, and the like. 


We can run chipsec_util.py command_name, where command_name is the name 
of the command we want to learn about, to output a description and usage 
information for that command. For instance, Listing 19-2 displays the out- 
put of chipsec_util.py spi. 





TEETH HHH H H H HHHH HH HHE HEH HHHH HH HH H H HHHH H HHHH HHHH 


HH ## 
## CHIPSEC: Platform Hardware Security Assessment Framework ## 
HH ## 


#НННННННННННННННННННННННННННННННННННННННННННННННННННННННННННННҤ 
[CHIPSEC] Version 1.3.3h 

[CHIPSEC] API mode: using OS native API (not using CHIPSEC kernel module) 
[CHIPSEC] Executing command 'spi' with args [] 


>>> chipsec util spi info|dump|read|write|erase|disable-wp 
[flash address] [length] [file] 


Examples: 


»»» chipsec util spi info 

»»» chipsec util spi dump rom.bin 

»»» chipsec util spi read 0x700000 0x100000 bios.bin 
»»» chipsec util spi write OxO flash descriptor.bin 
»»» chipsec util spi disable-wp 





listing 19-2: Description of and usage information for the spi module 


This is useful when we want to know the supported options for com- 
mands with self-describing names, like info, read, write, erase, or disable-wp Ө. 
In the upcoming examples, we'll primarily use the spi and uefi commands 
to acquire and unpack a firmware image. 


Dumping and Parsing the SPI Flash Image 


First we'll look at spi, which allows us to perform firmware acquisition. This 
command uses the software approach to dumping the contents of an SPI 
flash. To obtain an image of the SPI flash, we can run the following: 


chipsec util.py spi dump path to file 





where path to fileis a path to the location where we want to save the SPI 
image. Upon successful execution of this command, this file will contain 
the flash image. 

Now that we have the SPI flash image, we can parse it and extract use- 
ful information using the decode command (it's worth mentioning that the 
decode command by itself may be used to parse an SPI flash image obtained 
through the hardware method of firmware acquisition), like so: 





chipsec util.py decode path to file 





where path to file points to a file with an SPI flash image. Chipsec will 
parse and extract data stored in the flash image and store it in a directory. 
We can also perform this task with the uefi command and decode option, 
like this: 





chipsec util.py uefi decode path to file 
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Once we successfully execute the command, we obtain а set of objects 
extracted from the image, such as executable files, data files with NVRAM 
variables, and file sections. 


Dumping UEFI NVRAM Variables 


Now we'll use Chipsec to enumerate and extract UEFI variables from the 
SPI flash image. In Chapter 17, we briefly covered how to use chipsec uefi 
var-list to extract NVRAM variables. UEFI Secure Boot relies on NVRAM 
variables to store configuration data like its Secure Boot policy value, plat- 
form key, key exchange keys, and db and dbx data. Running this command 
will produce a list of all the UEFI NVRAM variables stored in the firmware 
image, along with their content and attributes. 

These are just a few commands out of the Chipsec tool's rich arsenal. 
А comprehensive list of all Chipsec use cases would require a book of 
its own, but if you're interested in the tool, we suggest checking out its 
documentation. 

This concludes our analysis of a firmware image with Chipsec. After 
executing these commands, we get the extracted contents of the firmware 
image. The next step in forensic analysis would be to analyze the extracted 
components individually, using tools specific to the type of extracted object. 
For instance, you can analyze PEI and DXE modules using IDA Pro disas- 
sembler, while you can browse UEFI NVRAM variables in a hex editor. 

This list of Chipsec commands serves as a good starting point for fur- 
ther exploration of UEFI firmware. We encourage you to play with this tool 
and refer to the manual to learn its other capabilities and features in order 
to deepen your knowledge of firmware forensic analysis. 


Conclusion 
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In this chapter, we discussed important approaches to UEFI firmware foren- 
sic analysis: acquiring firmware, and parsing and extracting information 
from a UEFI firmware image. 

We discussed two different ways to acquire firmware—the software 
approach and the hardware approach. The software approach is conve- 
nient, but it doesn't provide a completely trustworthy way of obtaining a 
firmware image from the target system. For this reason, we recommend 
the hardware approach, despite its higher difficulty. 

We also demonstrated how to use two open source tools indispens- 
able to analyzing and reverse engineering SPI flash images: UEFITool and 
Chipsec. UEFITool provides functionality for browsing, modifying, and 
extracting forensic data from an SPI flash image, and Chipsec is useful 
for performing many operations required in forensic analysis. The use of 
Chipsec also reveals how easily an attacker can modify the firmware image 
with a malicious payload, and so we expect interest in firmware forensics to 
significantly increase in the security industry. 
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